Who hosts and maintains a Supabase or web app in the UK?

Once a web app is built, someone has to run it: pay the hosting bills, apply security updates, watch for errors, check that backups actually restore, and make the small changes a live business always needs. For a UK small business that someone is usually the studio that built it, on a monthly care plan, a freelancer on call, or a developer you employ. For a typical app built on Supabase and Vercel, the platform bills alone start at about $45 a month (Supabase Pro from $25, Vercel Pro from $20) before anyone's time is paid for.

Who looks after a web app once it has been built?

A web app is looked after by whoever holds the keys to its hosting, database and code, and has agreed to keep it running. For most UK small businesses that is one of three people: the studio that built it, on a monthly hosting and care plan; a freelance developer paid by the hour when something breaks; or a developer on your own payroll. Each can work. The failure case is the fourth option, where nobody has agreed to it and the app quietly runs until the day it does not.

The studio route suits businesses without an in-house technical team, because the people who wrote the code already know where everything is. A freelancer suits an app that rarely changes, as long as you accept that nobody is watching between call-outs. Hiring makes sense once the app is the business and changes every week.

What should managed hosting and care cover for a web app?

Managed hosting and care for a web app should cover seven things: the hosting accounts and their bills, security and dependency updates, uptime and error monitoring with someone who receives the alerts, daily backups with restore tests, the domain and its DNS records, a set amount of small changes each month, and a short written report so you can see the work happening. If a plan is vague on any of those, ask before you sign.

• Hosting and bills: the Vercel, Supabase, domain and email accounts, kept in your business's name and paid on time.
• Security updates: the framework, the libraries the app depends on and the database client, updated on a schedule rather than when someone remembers.
• Monitoring: an uptime check and error tracking, and a named person who receives the alert.
• Backups: daily database backups and a periodic test that a backup really restores.
• Domain and DNS: renewals, SSL certificates and the email records that stop your messages landing in spam.
• Small changes: a wording change, a new field on a form, a fixed bug. Agree how many a month are included.
• Reporting: what was updated, what broke, what was fixed, and what is coming up.

What does it cost to run a small business web app each month?

A small business web app on Supabase and Vercel costs from about $45 a month in platform bills on their paid plans, plus the cost of whoever looks after it. Supabase and Vercel bill in US dollars. Card payments through Stripe add 1.5% + 20p per standard UK card. These are the published list prices on 24 October 2026:

Then there is the looking after. Our own plans are published on our pricing page: four monthly plans from £20 to £500, where we pay the platform bills and roll them into one invoice. The plans that include Pro-level Vercel and Supabase accounts start at £75 a month. A fully managed website manager service starts at £350 a month.

Can I run a business app on the free Supabase and Vercel plans?

Not safely. Supabase pauses free projects after one week without activity and takes no automatic backups on the free plan, and Vercel's Hobby plan is for personal, non-commercial use. Free plans are excellent for prototypes and demos. Once real customers and real data depend on the app, move it to paid plans before launch, not after the first scare.

The pause catches people out most. A demo shown to investors, or an internal tool used once a fortnight, can go a week without a visitor, and the next person to open it finds it asleep.

Can a Supabase app be hosted in the UK?

Yes. Supabase offers a London region, listed as eu-west-2, and the region you pick determines where your project's primary data is stored. The catch is timing: each project lives in one primary region chosen when it is created, and Supabase cannot move an existing project. Changing region means creating a new project in London and migrating the data across.

That migration is manageable but not free. The app's API address and keys change, so every environment that talks to the database needs updating, and sign-in providers such as Google have to be reconnected by hand. If UK hosting matters to you or your customers, choose London on day one.

Where does a web app hosted on Vercel actually run?

A web app on Vercel runs in two places. Static pages, images and scripts are cached and served from Vercel's network close to each visitor. Server code, the part that talks to your database, runs in one region you choose, and for new projects that default is Washington, D.C. (iad1). If your Supabase database is in London, set the function region to London (lhr1) so each database request stays inside the UK.

Vercel's own documentation recommends running functions in the same region as the database, or as close as possible. A London database answering a server in Washington adds a transatlantic round trip to every query, which users feel as a slow app even when nothing is broken.

Does UK GDPR require my app's data to be stored in the UK?

UK GDPR does not, on its own, require personal data to be stored in the UK. What it controls is sending personal data to, or making it accessible to, a separate organisation outside the UK. The ICO calls that a restricted transfer, and each one must be covered by UK adequacy regulations, an appropriate safeguard such as the International Data Transfer Agreement, or a narrow exception.

Hosting in London keeps the stored data in the UK and makes procurement questionnaires simpler, but your providers are still separate organisations with their own support teams and sub-processors. Your privacy notice and data processing agreements need to cover them either way. This is general information, not legal advice; the ICO's guide is linked at the end.

How often should a web app get security updates?

Within 14 days of release for anything serious. The UK government's Cyber Essentials scheme, in its April 2026 requirements, says updates that fix vulnerabilities the vendor calls critical or high risk, or that score 7 or above on CVSS v3, must be applied within 14 days of release, and recommends applying all updates within that window. It is a sensible standard to write into any care agreement for a web app.

In practice that means someone reviews the app's dependencies every week, applies the urgent ones quickly, batches the rest, and redeploys after checking nothing broke. An app nobody has updated for a year is not stable, it is just untested.

How are a Supabase app's backups handled, and who tests them?

On Supabase's Pro plan the database is backed up daily and the last 7 days can be restored; the Team plan keeps 14 days. Point-in-time recovery is an add-on that narrows the worst-case data loss to about two minutes. None of that helps if nobody has ever tried a restore, so ask your provider when they last restored a backup and what they restored it to.

On our own plans, backup restores are tested quarterly on the entry plan and monthly on the others. Files people upload to the app, such as photos and documents, need their own plan: Supabase's documentation says database backups do not include objects stored through its Storage service, so ask how those are covered too.

What should I ask a hosting and care provider before signing?

1. Whose name are the accounts in? The code repository, Vercel, Supabase, the domain and Stripe should all belong to your business.
2. Which region is the database in, and where do the server functions run?
3. Who pays the platform bills, and are they passed on at cost or marked up?
4. How quickly are critical security updates applied? Fourteen days is the Cyber Essentials benchmark.
5. When did you last test a restore from backup, and how are uploaded files backed up?
6. Who receives the alert when the app goes down at night, and what happens next?
7. How many changes or hours are included each month, and what does extra work cost?
8. How fast do you reply, and is that written down?
9. Will I deal with one named person or a ticket queue?
10. What happens if I leave? You should get every login, the code and a handover note, with nothing to buy back.

Can a new provider take over an app someone else built?

Usually, yes. A sensible provider starts with a short audit: who owns which accounts, what versions everything is on, whether backups exist, and where the obvious risks are. They then quote any stabilisation work before taking it onto a monthly plan. If the original developer has disappeared, the first job is recovering access to the accounts, which is why it matters that they were in your name from the start.

How does BozApps look after web apps?

We host the apps we build, and apps others built once we have audited them, on Vercel, Supabase and Cloudflare, with uptime and error monitoring, dependency and security patching, daily backups, and small improvements each month. One named engineer knows your app end to end. We pay the platform bills and put them on one monthly invoice, and the code stays in your own GitHub, so you can leave with everything.

Plans run from £20 to £500 a month on our pricing page. Read what the service covers on managed hosting and care, or, if your business is in the capital, on managed hosting in London. If the app does not exist yet, start with our guide to turning an idea into a first working version, or compare Supabase and Firebase.

Where do these facts come from?

• Supabase pricing: plan prices, free project pausing, backup retention and the point-in-time recovery add-on. Checked 24 October 2026.
• Supabase regions and changing a project's region, Supabase documentation.
• Supabase database backups, Supabase documentation.
• Vercel pricing and configuring regions for Vercel Functions, Vercel documentation updated 11 August 2026.
• Stripe UK pricing. Checked 24 October 2026.
• Cyber Essentials: Requirements for IT Infrastructure v3.3, NCSC, April 2026, section on security update management.
• International transfers: a guide, Information Commissioner's Office, published 15 January 2026.